362eb487f2b15f41229598b37db6a304a756ace60970cfb3b8f9e58d531b9b48

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Size 91KB
Sample240603-e6s5gsbe5s
SHA256 362eb487f2b15f41229598b37db6a304a756ace60970cfb3b8f9e58d531b9b48
MD5 9bb1f8124fa679b710bd32b1d0633400
SHA1 27417fe38990574bd56167cb3a8c071bb5454d24
SHA512 2103253d06ed16b5fe4244a460dad4a971fbca68e2edbeebf49deef677529b050a2658e4e0f17de4156959229906d379ad3af7212b357b8c7bb0535f392df230
SSDEEP 1536:kRsjd3GR2Dxy387Lnouy8VTPRsjd3GR2Dxy387Lnouy8VTY:kOgUXoutNPOgUXoutNY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 7 IoCs

pid	Process
1764	xk.exe
312	IExplorer.exe
2000	WINLOGON.EXE
2260	CSRSS.EXE
1592	SERVICES.EXE
1988	LSASS.EXE
820	SMSS.EXE

Loads dropped DLL 12 IoCs

pid	Process
2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2164-0-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0007000000015023-8.dat	upx
behavioral1/files/0x00090000000155e3-109.dat	upx
behavioral1/memory/1764-112-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/1764-115-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0006000000015cf7-116.dat	upx
behavioral1/memory/2164-117-0x0000000001D30000-0x0000000001D5F000-memory.dmp	upx
behavioral1/memory/312-127-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0006000000015d5d-128.dat	upx
behavioral1/memory/2000-138-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0006000000015d6e-141.dat	upx
behavioral1/memory/2000-140-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2260-149-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0006000000015f1b-159.dat	upx
behavioral1/memory/1592-162-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2164-160-0x0000000001D30000-0x0000000001D5F000-memory.dmp	upx
behavioral1/memory/1592-164-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2164-189-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/820-188-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2164-178-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/1988-177-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2260-152-0x0000000000400000-0x000000000042F000-memory.dmp	upx

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\IExplorer.exe	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\shell.exe	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Mig2.scr	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xk.exe	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
File created	C:\Windows\xk.exe	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop\	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
1764	xk.exe
312	IExplorer.exe
2000	WINLOGON.EXE
2260	CSRSS.EXE
1592	SERVICES.EXE
1988	LSASS.EXE
820	SMSS.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 1764	2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe	28
PID 2164 wrote to memory of 1764	2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe	28
PID 2164 wrote to memory of 1764	2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe	28
PID 2164 wrote to memory of 1764	2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe	28
PID 2164 wrote to memory of 312	2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe	29
PID 2164 wrote to memory of 312	2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe	29
PID 2164 wrote to memory of 312	2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe	29
PID 2164 wrote to memory of 312	2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe	29
PID 2164 wrote to memory of 2000	2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe	30
PID 2164 wrote to memory of 2000	2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe	30
PID 2164 wrote to memory of 2000	2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe	30
PID 2164 wrote to memory of 2000	2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe	30
PID 2164 wrote to memory of 2260	2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe	31
PID 2164 wrote to memory of 2260	2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe	31
PID 2164 wrote to memory of 2260	2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe	31
PID 2164 wrote to memory of 2260	2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe	31
PID 2164 wrote to memory of 1592	2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe	32
PID 2164 wrote to memory of 1592	2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe	32
PID 2164 wrote to memory of 1592	2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe	32
PID 2164 wrote to memory of 1592	2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe	32
PID 2164 wrote to memory of 1988	2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe	33
PID 2164 wrote to memory of 1988	2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe	33
PID 2164 wrote to memory of 1988	2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe	33
PID 2164 wrote to memory of 1988	2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe	33
PID 2164 wrote to memory of 820	2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe	34
PID 2164 wrote to memory of 820	2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe	34
PID 2164 wrote to memory of 820	2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe	34
PID 2164 wrote to memory of 820	2164	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe	34

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9bb1f8124fa679b710bd32b1d0633400_NeikiAnalytics.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2164
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1764
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:312
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2000
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2260
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1592
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1988
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

SERVICES.EXE

Path C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
Size 91KB
SHA256 7e69bd6d0bd73304f2070a41f326b3d4f045188c1640381d74f32e25aee984dc
MD5 e42eb536dcd04791bff28bbf799272b0
SHA1 86b80bf1b8ef1a466fbdf0fece76778e67ae4192
SHA512 11c6d87c61e4fa372d74a723da50cb5804be052f6b617fc381fe4f854c11da0c0c1d0fb617be1216fd57110ffff6d6d41e3f56f4db9e73993baada9c216199ac
SSDEEP 1536:kRsjd3GR2Dxy387Lnouy8VT0Rsjd3GR2Dxy387Lnouy8VTY:kOgUXoutN0OgUXoutNY
MD5 SHA1 SHA512 SSDEEP

Submit Download

winlogon.exe

Path C:\Users\Admin\AppData\Local\winlogon.exe
Size 91KB
SHA256 362eb487f2b15f41229598b37db6a304a756ace60970cfb3b8f9e58d531b9b48
MD5 9bb1f8124fa679b710bd32b1d0633400
SHA1 27417fe38990574bd56167cb3a8c071bb5454d24
SHA512 2103253d06ed16b5fe4244a460dad4a971fbca68e2edbeebf49deef677529b050a2658e4e0f17de4156959229906d379ad3af7212b357b8c7bb0535f392df230
SSDEEP 1536:kRsjd3GR2Dxy387Lnouy8VTPRsjd3GR2Dxy387Lnouy8VTY:kOgUXoutNPOgUXoutNY
MD5 SHA1 SHA512 SSDEEP

Submit Download

xk.exe

Path C:\Windows\xk.exe
Size 91KB
SHA256 448e37d9e1ef5f4cc577bf4f625cb9373229f0225e8c79f6f2256ca182f157f8
MD5 1027c58de7c1e8cf0e719593a365a736
SHA1 e392ba25f37303107a26a66df7482e9d4d17012d
SHA512 e8209a74375788803781ca535d2f70717766b944d76c0d740dd282ba658097841890c7e66d6953ceb9e5431b602b7c088b4d85b086b0c493fa07e63304e10b4a
SSDEEP 1536:kRsjd3GR2Dxy387Lnouy8VTXRsjd3GR2Dxy387Lnouy8VTY:kOgUXoutNXOgUXoutNY
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSRSS.EXE

Path \Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
Size 91KB
SHA256 fcb8548cc9cfface9b935e9dc7d0ae4a4433be5d8eda60991973b60f079b43b1
MD5 41f73a1f791dab88cde5c6b431ad18cb
SHA1 9594d37c7d335e23ec916afe7fa3b40951b637a4
SHA512 bdbcbf75d6cb876b9314379d780da6f2f23b1db9a87a65eff3a7fa657be0c2c1ea57bf545500b0c6f97977ac3ea683207d6b2b428fc879f84ae285965f453e07
SSDEEP 1536:kRsjd3GR2Dxy387Lnouy8VTaRsjd3GR2Dxy387Lnouy8VTY:kOgUXoutNaOgUXoutNY
MD5 SHA1 SHA512 SSDEEP

Submit Download

WINLOGON.EXE

Path \Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
Size 91KB
SHA256 f8c2b1931ff748caec843cdb8691517c140300f3c62603928d2be1d1b11a3550
MD5 bb3d494a0ab6e8d357cbdc9472c4b711
SHA1 4e552329d030c773bb0ec0dfb9eec0647bde84a1
SHA512 3622c5dd4e8e3096b3ea82dab2149101ffb4857a217b99942106e3f4b0b840afa99d72df815c44159f8513c145fde0b0d0f85655177eea192648959f1892c501
SSDEEP 1536:kRsjd3GR2Dxy387Lnouy8VTiRsjd3GR2Dxy387Lnouy8VTY:kOgUXoutNiOgUXoutNY
MD5 SHA1 SHA512 SSDEEP

Submit Download

IExplorer.exe

Path \Windows\SysWOW64\IExplorer.exe
Size 91KB
SHA256 8ef6010fb1c41a4316bcf884c0696e0875b7d86be45328ac32188d0b4587a2c9
MD5 fcb9b0e89f30471e3d7232590246fc3d
SHA1 3ce7b7e5dcc24a86584b6b3eb775715e107c2259
SHA512 082c3adbd1425fbc0597b51f5f09ecb128ae800d5fda86935033a2ef97513a012979c568948432bb31badab424bf71b18d153bbdf709363996470756a340f097
SSDEEP 1536:kRsjd3GR2Dxy387Lnouy8VT/Rsjd3GR2Dxy387Lnouy8VTY:kOgUXoutN/OgUXoutNY
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/312-127-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/820-188-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1592-164-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1592-162-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1764-115-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1764-112-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/1988-177-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2000-140-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2000-138-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2164-111-0x0000000001D30000-0x0000000001D5F000-memory.dmp

Download

memory/2164-148-0x0000000001D30000-0x0000000001D5F000-memory.dmp

Download

memory/2164-0-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2164-124-0x0000000001D30000-0x0000000001D5F000-memory.dmp

Download

memory/2164-160-0x0000000001D30000-0x0000000001D5F000-memory.dmp

Download

memory/2164-117-0x0000000001D30000-0x0000000001D5F000-memory.dmp

Download

memory/2164-189-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2164-110-0x0000000001D30000-0x0000000001D5F000-memory.dmp

Download

memory/2164-178-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2164-137-0x0000000001D30000-0x0000000001D5F000-memory.dmp

Download

memory/2260-149-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/2260-152-0x0000000000400000-0x000000000042F000-memory.dmp

Download